A map of AI verification technologies
The map covers technical means of verifying claims about AI hardware and software.
- Claims are what one party wants to verify.
- Mechanisms are general techniques for verifying a claim.
- Implementations are specific systems that realise a mechanism.
Claims and mechanisms
- Compute stock is at most a declared amount
- Chips are where they are declared to be
- Declared hardware is idle or shut down
- This compute runs inference, not training
- The declared model is the one being served
- Declared safeguards were applied during inference
- A training run stayed within declared limits
- Communication between compute groups is bounded
- Model weights have not left the facility
- There is no undeclared relevant compute
On-chip & hardware-enabled
Compute stock is at most a declared amount
Supporting work only
Compute accounting & provenance
Compute stock is at most a declared amount
1 mechanism aimed at this claim
Remote & side-channel sensing
Compute stock is at most a declared amount
Supporting work only
On-chip & hardware-enabled
Chips are where they are declared to be
Supporting work only
Cryptographic & computational
Chips are where they are declared to be
Supporting work only
Compute accounting & provenance
Chips are where they are declared to be
1 mechanism aimed at this claim
Also relevant
On-chip & hardware-enabled
Declared hardware is idle or shut down
1 mechanism aimed at this claim
- R2On-chip telemetry from timing, memory and performance countersUses timing, memory-residency and performance-counter signals measured on AI accelerators as evidence about which workloads they are running.⚠
Also relevant
Cryptographic & computational
Declared hardware is idle or shut down
1 mechanism aimed at this claim
Also relevant
On-chip & hardware-enabled
This compute runs inference, not training
1 mechanism aimed at this claim
- R2On-chip telemetry from timing, memory and performance countersUses timing, memory-residency and performance-counter signals measured on AI accelerators as evidence about which workloads they are running.⚠
Also relevant
Off-chip devices & sensors
This compute runs inference, not training
1 mechanism aimed at this claim
Also relevant
Cryptographic & computational
This compute runs inference, not training
1 mechanism aimed at this claim
Also relevant
- R3Deterministic and bit-exact inferencesupporting
- R3Sampled inference recomputationsupporting
- R2Timed challenge-response and memory-occupation challengessupporting
- R2Zero-knowledge proofs of inferencesupporting
- R3Pearl proof-of-useful-work blockchainimplementation
- R1Attestable zero-knowledge inference proverimplementation
Isolation & system architectures
This compute runs inference, not training
1 mechanism aimed at this claim
Also relevant
- R2Bandwidth limits and compartmentalizationsupporting
- R2Bounding unexplained information in outputssupporting
- R1Memory wiping and proofs of secure erasuresupporting
- R1AI 2040 inference-only verification stackimplementation
- R1Low-trust AI compute verification system overviewimplementation
- R1RAND secure inference data center (SIDC) designimplementation
Remote & side-channel sensing
This compute runs inference, not training
1 mechanism aimed at this claim
On-chip & hardware-enabled
The declared model is the one being served
1 mechanism aimed at this claim
- R3TEE remote attestation for AI workloadsTrusted execution environments (TEEs) in CPUs and GPUs sign reports of loaded software, so a remote party can check which code ran an AI workload.⚠
Also relevant
Off-chip devices & sensors
The declared model is the one being served
Supporting work only
- R1Network taps and certifierssupportingDevices on a cluster's network links that copy and hash all traffic, so a verifier can later check sampled records against declared work.
- R1SASH confidential network loggerimplementationAn open-source prototype that routes a facility's inference traffic through a logger and re-runs requests on a separate cluster to check it serves inference.
Cryptographic & computational
The declared model is the one being served
5 mechanisms aimed at this claim
- R3Deterministic and bit-exact inferenceMaking model inference reproducible bit for bit, so that a verifier's re-run must match the provider's output exactly rather than approximately.
- R3Model identity attestationEstablishes that responses come from a specific, committed set of model weights, using enclave measurements or recomputation of sampled outputs.⚠
- R3Sampled inference recomputationA verifier re-runs a random sample of an AI provider's logged queries on a trusted copy of the declared model and checks the outputs match.
- R2Confidential multi-party verificationLets mutually distrusting parties run an agreed check over private models or records inside attested enclaves or zero-knowledge proofs, revealing only the result.
- R2Zero-knowledge proofs of inferenceA prover produces a cryptographic proof that an output came from running a committed model on a given input, without revealing the weights.
Also relevant
- R2Safeguard attestationsupporting
- R3Tinfoil model identity (Modelwrap)implementation⚠
- R3TOPLOCimplementation
- R3Verde and RepOps (Gensyn)implementation
- R2Attestable Auditsimplementation
- R2Batch-invariant inference kernels (Thinking Machines)implementation
- R2DiFR (Divergence From Reference)implementation
- R2EZKLimplementation
- R2PySyft double-blind evaluationsimplementation
- R2zkLLMimplementation
- R1AI 2040 inference-only verification stackimplementation
- R1Attestable zero-knowledge inference proverimplementation
- R1Low-trust AI compute verification system overviewimplementation
- R1SASH confidential network loggerimplementation
Isolation & system architectures
The declared model is the one being served
Supporting work only
- R1AI 2040 inference-only verification stackimplementationA proposed retrofit that isolates data-centre inference units, taps their front-end traffic and recomputes random samples to check that only declared inference runs.
- R1Low-trust AI compute verification system overviewimplementationA retrofittable reference design in which network taps commit to all facility traffic, and air-gapped, independently sourced checkers later re-run randomly challenged records.
- R1RAND secure inference data center (SIDC) designimplementationA RAND design for a purpose-built facility that serves already-trained AI models while protecting weights and inference data against state-level attackers.
On-chip & hardware-enabled
Declared safeguards were applied during inference
Supporting work only
- R3TEE remote attestation for AI workloadssupportingTrusted execution environments (TEEs) in CPUs and GPUs sign reports of loaded software, so a remote party can check which code ran an AI workload.⚠
- R1Hardware-enabled guarantees (flexHEG) and guarantee processorssupportingProposed chip add-ons, a guarantee processor inside a tamper-protected enclosure, that would check and enforce agreed rules on how AI accelerators are used.
- R2Attestable AuditsimplementationA research prototype that runs AI safety benchmarks inside a trusted execution environment and publishes attestations binding the model, the audit and the results.
Cryptographic & computational
Declared safeguards were applied during inference
1 mechanism aimed at this claim
Also relevant
Isolation & system architectures
Declared safeguards were applied during inference
Supporting work only
On-chip & hardware-enabled
A training run stayed within declared limits
1 mechanism aimed at this claim
Also relevant
Cryptographic & computational
A training run stayed within declared limits
2 mechanisms aimed at this claim
- R2Training-transcript verification (proof-of-learning)A trainer logs checkpoints, data order and settings, so a verifier can re-run sampled training segments and check that the claimed training happened.⚠
- R2Zero-knowledge proofs of training constraintsCryptographic proofs that a training run followed a committed dataset, procedure and rules, checkable without revealing the model or the data.
Also relevant
Isolation & system architectures
A training run stayed within declared limits
Supporting work only
- R2Bandwidth limits and compartmentalizationsupportingCapping or removing network links between groups of accelerators, so that serving within each group still works but large training across groups becomes far slower.
- R1Whole-workload recomputation (reproducible packets)supportingOrganizing all AI workloads in a facility into discrete, reproducible units, so that a verifier can recompute a random sample and check each one.
Remote & side-channel sensing
A training run stayed within declared limits
Supporting work only
On-chip & hardware-enabled
Communication between compute groups is bounded
Supporting work only
Off-chip devices & sensors
Communication between compute groups is bounded
1 mechanism aimed at this claim
Also relevant
Isolation & system architectures
Communication between compute groups is bounded
1 mechanism aimed at this claim
Also relevant
Off-chip devices & sensors
Model weights have not left the facility
Supporting work only
- R1Network taps and certifierssupportingDevices on a cluster's network links that copy and hash all traffic, so a verifier can later check sampled records against declared work.
- R1Side-channel suppression for isolated facilitiessupportingShielding, filtering, jamming and inspecting an AI facility to limit hidden physical communication around monitored network links.
Cryptographic & computational
Model weights have not left the facility
Supporting work only
- R3Deterministic and bit-exact inferencesupportingMaking model inference reproducible bit for bit, so that a verifier's re-run must match the provider's output exactly rather than approximately.
- R3Model identity attestationsupportingEstablishes that responses come from a specific, committed set of model weights, using enclave measurements or recomputation of sampled outputs.⚠
- R3Sampled inference recomputationsupportingA verifier re-runs a random sample of an AI provider's logged queries on a trusted copy of the declared model and checks the outputs match.
- R2DiFR (Divergence From Reference)implementationDiFR checks that an inference provider ran its declared model by comparing output tokens or activations with a trusted re-run using the same random seed.
Isolation & system architectures
Model weights have not left the facility
1 mechanism aimed at this claim
Also relevant
On-chip & hardware-enabled
There is no undeclared relevant compute
Supporting work only
Cryptographic & computational
There is no undeclared relevant compute
Supporting work only
- R3Deterministic and bit-exact inferencesupportingMaking model inference reproducible bit for bit, so that a verifier's re-run must match the provider's output exactly rather than approximately.
- R1Proofs of useful work for capacity accountingsupportingCryptographic evidence that a given amount of matrix-multiplication work was completed, proposed as one input to accounting for spare capacity on declared hardware.
- R3Pearl proof-of-useful-work blockchainimplementationA blockchain whose mining is designed to be a by-product of GPU matrix multiplications in AI workloads, with public node and miner code.
Isolation & system architectures
There is no undeclared relevant compute
Supporting work only
Compute accounting & provenance
There is no undeclared relevant compute
Supporting work only
- R1Chip location verificationsupportingTiming a chip's signed replies to trusted servers at known places, so that the speed of light bounds how far away the chip can be.
- R1Chip registries and manufacturing recordssupportingRecording each AI chip's identity and owner from the fab onwards, and cryptographically fixing manufacturing records, so that chips can be accounted for later.
Remote & side-channel sensing
There is no undeclared relevant compute
1 mechanism aimed at this claim
Categories
- On-chip & hardware-enabled
- Mechanisms built into accelerators or their firmware: trusted execution, attestation, hardware-enabled governance, on-chip telemetry and limits.4 mechanisms · 2 implementations
- Off-chip devices & sensors
- Retrofittable devices outside the accelerator: network taps and certifiers, power and analog sensors, tamper-evident enclosures.3 mechanisms · 1 implementation
- Cryptographic & computational
- Protocols that check computation itself: recomputation, zero-knowledge proofs, proofs of learning, proofs of work, challenge-response.10 mechanisms · 10 implementations
- Isolation & system architectures
- Ways of arranging or constraining a facility so that other checks become possible: bandwidth limits, compartmentalization, memory wiping, secure facilities, whole verification stacks.4 mechanisms · 3 implementations
- Compute accounting & provenance
- Establishing what compute exists, where it is and what it can do: chip registries, manufacturing records, location verification, capacity bounds.2 mechanisms · 1 implementation
- Remote & side-channel sensing
- Inferring activity from outside or from physical signals: detecting data centres, classifying workloads from power or other emissions.2 mechanisms